NSA, CISA, FBI Warn: AI Is Lowering the Bar for Attacking Power Grids and Water Plants

Cybersecurity officials at the National Security Agency (NSA), the Cybersecurity & Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have warned that malicious actors are using AI to create malicious scripts targeting Siemens S7 industrial control systems — which manage electricity grids, water treatment facilities, chemical processes and manufacturing plants. “AI dramatically reduces the technical expertise and development time necessary to craft functional exploits,” they said.

The attack process is simple, involving the collection of open source information regarding vulnerabilities, searching for internet-accessible controllers through search engines, and delivering AI-based scripts to exploit the devices. “Adversaries need no prior knowledge or experience with industrial protocols to carry out these attacks,” the government warns.

In the past, compromising critical infrastructure meant relying on a small cadre of experts with access to state-level resources. Now, thanks to AI, compromising power plants and factories is within reach of a much broader set of attackers.